Cross-site Scripting (XSS) - Stored in orchardcms/orchardcore


Reported on

Jan 11th 2022


The application does not escape special characters before output to FE, lead to stored XSS.

Proof of Concept

  1. Go to Workflows > Create Workflow > Add Task/Event

  2. Set a title with XSS payload, e.g: aa<svg/onload=alert('hacked')>


XSS can have huge implications for a web application and its users. User accounts can be hijacked, change the html screen and insult the organization. Credentials could be stolen, sensitive data could be exfiltrated, and lastly, access to your client computers can be obtained.

We are processing your report and will contact the orchardcms/orchardcore team within 24 hours. 2 years ago
A GitHub Issue asking the maintainers to create a exists 2 years ago
We have contacted a member of the orchardcms/orchardcore team and are waiting to hear back 2 years ago
We have sent a follow up to the orchardcms/orchardcore team. We will try again in 4 days. 2 years ago
orchardcms/orchardcore maintainer validated this vulnerability 2 years ago
laladee has been awarded the disclosure bounty
The fix bounty is now up for grabs
orchardcms/orchardcore maintainer marked this as fixed in 1.2.2 with commit 218f25 2 years ago
The fix bounty has been dropped
to join this conversation